Self-Hosted NetBird: Your Own Mesh VPN Server

NetBird is an open-source mesh VPN built on WireGuard. Each device runs the NetBird client; the server you host tells the devices about each other, and they build encrypted tunnels directly between them. Choose it with a plan, pay, and we build the VPS (KVM, NVMe, Ubuntu 24.04 LTS) and install it in about three minutes after boot. You get:

• NetBird 0.81.5, the combined server (management, signal, relay, STUN and its built-in identity provider) under the AGPL-3.0, plus the NetBird dashboard.
• Your account ready: you log in to the dashboard with your Devoster account email and a generated password shown in the Devoster dashboard. NetBird's first-run setup is done before the address goes public, so nobody else can claim the server.
• Local users, no outside login service. Accounts live on your server, with email and password; you don't need Google, Microsoft or another identity provider to start.
• An HTTPS address like vpn-k3x9a2.devoster.app with a Let's Encrypt certificate, and NetBird's anonymous usage reports switched off.
• Dashboard controls to open NetBird, reset your password, restart, stop or start it, read its logs, run an update and connect your own domain.

The app is free; you pay only the VPS plan, with 10% off yearly. The server comes with full root, free nightly backups kept 3 days plus one snapshot, a dedicated IPv4, 1 Gbps with unlimited bandwidth and DDoS protection. Already have a Devoster VPS? NetBird is the exception among our apps: it can't be added to a server that is already running, because it brings its own HTTPS proxy on ports 80 and 443. You can reinstall an existing server with it from VPS Control at no charge, which replaces everything on that server. Other apps are on the One-Click Apps page.

The NetBird apps for Windows, macOS, Linux, Android and iOS connect to NetBird's own cloud service unless you tell them otherwise. Before you sign in, point the client at your server, or you will end up creating an account in NetBird's cloud instead:

• Desktop apps: on first launch, choose a self-hosted server and enter your address, https://vpn-k3x9a2.devoster.app in this example. Then sign in with your email and password in the browser window that opens.
• Phones: change the server in the app's settings to your address before signing in.
• Linux servers and the command line: netbird up --management-url https://your-address, which opens a browser login. For machines without a person at them, create a setup key in the dashboard and run netbird up --setup-key YOUR-KEY --management-url https://your-address.

Each device then gets a private NetBird IP address and shows up in the dashboard under Peers. If you later connect your own domain, devices already set up with the devoster.app address keep connecting, and the dashboard moves to your domain.

NetBird decides who can reach what with groups and policies, managed in the dashboard:

• Groups: put devices in groups such as "laptops", "servers" or "office", by hand or through the setup key that enrolled them.
• Access policies: allow one group to reach another, optionally only on certain ports and protocols. A new NetBird account starts with a default policy that lets every device reach every other; replace it with your own rules once you have more than a few devices.
• Adding people: invite users from the dashboard. Your server sends no email, so NetBird gives you an invite link to pass on yourself; they set their password there and then sign in from their own devices.
• Reaching a whole network: a device running NetBird can act as a router for the network behind it, such as an office LAN or a cloud VPC, so other devices reach machines there that don't run the client.

Both use WireGuard, and we offer both. They are built for different jobs:

NetBird needs 3478/udp open on the server for STUN, which devices use to discover their public address and connect directly through NAT. That port is opened with the install. The relay runs over port 443, so devices behind strict firewalls still connect, just with traffic passing through your VPS.

Little. The NetBird server coordinates devices and holds its data in a small SQLite database; it doesn't carry your traffic when devices connect directly. What uses CPU and bandwidth is the relay, when devices can't reach each other directly and their traffic passes through the VPS.

• Nano (1 vCPU, 1 GB): runs it for a few personal devices.
• Micro (1 vCPU, 2 GB), recommended: room for a team or a homelab with dozens of devices and the dashboard.
• Starter (2 vCPU, 4 GB): when many devices are behind strict networks and lean on the relay.

Bandwidth is unlimited on every plan at 1 Gbps, so relayed traffic doesn't run into a monthly cap.

Updates: we check new NetBird versions and apply them in a maintenance hour you choose, or when you press Update now. A snapshot of the VPS is taken first, and if NetBird doesn't come back healthy the server is rolled back automatically. Keep the clients on your devices reasonably up to date too.

Locked out? Reset password in the Devoster dashboard sets a new password for your account on the server. The server restarts briefly; your devices keep their setup and reconnect.

Backups: nightly backups (3 days) and your snapshot slot cover the whole VPS, including NetBird's database of devices, groups and policies.

The server is unmanaged: you have full root, and its security and who you let into your network are your responsibility. Our VPS hardening checklist covers SSH keys and the firewall; leave ports 80, 443 and 3478/udp open for NetBird. NetBird is developed by NetBird GmbH; Devoster isn't affiliated with it, and this is not NetBird's cloud service.